shell script: use sudo inside it vs run it with sudo?

up vote
1
down vote

favorite

When writing a shell script, in which some but not all commands in it need superuser privileges, shall I

add sudo to those commands which need superuser privileges, and run the shell script without sudo, or

don't add sudo to those commands which need superuser privileges, but run the shell script with sudo?

In the second way I will only need to provide my password once, but all the commands in the script will be run with superuser privilleges, including those commands which don't need.

In the first way I may need to provide my password multiple times for different sudo commands, while the superuser privileges are granted only to those commands which need them.

From security concern, the first way is better. For convenience, the second way is better.

I have been thinking of adopting the first way. So I have to deal with the inconvenience of providing my passwords to multiple sudo commands in the shell script.

Stephen Harris wrote at https://unix.stackexchange.com/a/478786/674:

A well written script would detect if it was running with the right permissions and not call sudo at all, but there's a lot of bad scripts

So should I use the second way? If so,

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

Thanks.

edited 1 hour ago

Vlastimil

7,0791152126

asked 2 hours ago

Tim

24.4k69238426

add a commentÂ |Â

up vote
1
down vote

favorite

When writing a shell script, in which some but not all commands in it need superuser privileges, shall I

add sudo to those commands which need superuser privileges, and run the shell script without sudo, or

don't add sudo to those commands which need superuser privileges, but run the shell script with sudo?

In the second way I will only need to provide my password once, but all the commands in the script will be run with superuser privilleges, including those commands which don't need.

In the first way I may need to provide my password multiple times for different sudo commands, while the superuser privileges are granted only to those commands which need them.

From security concern, the first way is better. For convenience, the second way is better.

I have been thinking of adopting the first way. So I have to deal with the inconvenience of providing my passwords to multiple sudo commands in the shell script.

Stephen Harris wrote at https://unix.stackexchange.com/a/478786/674:

A well written script would detect if it was running with the right permissions and not call sudo at all, but there's a lot of bad scripts

So should I use the second way? If so,

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

Thanks.

edited 1 hour ago

Vlastimil

7,0791152126

asked 2 hours ago

Tim

24.4k69238426

add a commentÂ |Â

up vote
1
down vote

favorite

When writing a shell script, in which some but not all commands in it need superuser privileges, shall I

add sudo to those commands which need superuser privileges, and run the shell script without sudo, or

don't add sudo to those commands which need superuser privileges, but run the shell script with sudo?

In the second way I will only need to provide my password once, but all the commands in the script will be run with superuser privilleges, including those commands which don't need.

In the first way I may need to provide my password multiple times for different sudo commands, while the superuser privileges are granted only to those commands which need them.

From security concern, the first way is better. For convenience, the second way is better.

I have been thinking of adopting the first way. So I have to deal with the inconvenience of providing my passwords to multiple sudo commands in the shell script.

Stephen Harris wrote at https://unix.stackexchange.com/a/478786/674:

A well written script would detect if it was running with the right permissions and not call sudo at all, but there's a lot of bad scripts

So should I use the second way? If so,

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

Thanks.

edited 1 hour ago

Vlastimil

7,0791152126

asked 2 hours ago

Tim

24.4k69238426

When writing a shell script, in which some but not all commands in it need superuser privileges, shall I

add sudo to those commands which need superuser privileges, and run the shell script without sudo, or

don't add sudo to those commands which need superuser privileges, but run the shell script with sudo?

In the second way I will only need to provide my password once, but all the commands in the script will be run with superuser privilleges, including those commands which don't need.

In the first way I may need to provide my password multiple times for different sudo commands, while the superuser privileges are granted only to those commands which need them.

From security concern, the first way is better. For convenience, the second way is better.

I have been thinking of adopting the first way. So I have to deal with the inconvenience of providing my passwords to multiple sudo commands in the shell script.

Stephen Harris wrote at https://unix.stackexchange.com/a/478786/674:

A well written script would detect if it was running with the right permissions and not call sudo at all, but there's a lot of bad scripts

So should I use the second way? If so,

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

Thanks.

shell-script scripting sudo root

edited 1 hour ago

Vlastimil

7,0791152126

asked 2 hours ago

Tim

24.4k69238426

edited 1 hour ago

Vlastimil

7,0791152126

asked 2 hours ago

Tim

24.4k69238426

edited 1 hour ago

Vlastimil

7,0791152126

edited 1 hour ago

Vlastimil

7,0791152126

edited 1 hour ago

Vlastimil

7,0791152126

asked 2 hours ago

Tim

24.4k69238426

asked 2 hours ago

Tim

24.4k69238426

asked 2 hours ago

Tim

24.4k69238426

add a commentÂ |Â

1 Answer
1

active

oldest

votes

up vote
3
down vote

To address your first issue:

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

There is a simple and POSIX check for root:

#!/bin/sh

AmIRoot()

 [ "$(id -u)" -eq 0 ]

Alternatively, in Bash, more performance-driven coders might want to use:

#!/bin/bash

AmIRoot()

Note that I intentionally wrapped the code in functions for re-use.

To address your second issue:

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

You can't do much about this. At least nothing comes to my mind. If I saw the script, I might have suggestions. But since you did not include it in your question... If you run the whole script with sudo or as root, I see no way to control this.

edited 1 hour ago

answered 1 hour ago

Vlastimil

7,0791152126

sudo -u "$SUDO_USER" command...?
â€“Â Michael Homer
1 hour ago

add a commentÂ |Â

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "106"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f479055%2fshell-script-use-sudo-inside-it-vs-run-it-with-sudo%23new-answer', 'question_page');

);

Post as a guest

Name

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

up vote
3
down vote

To address your first issue:

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

There is a simple and POSIX check for root:

#!/bin/sh

AmIRoot()

 [ "$(id -u)" -eq 0 ]

Alternatively, in Bash, more performance-driven coders might want to use:

#!/bin/bash

AmIRoot()

Note that I intentionally wrapped the code in functions for re-use.

To address your second issue:

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

edited 1 hour ago

answered 1 hour ago

Vlastimil

7,0791152126

sudo -u "$SUDO_USER" command...?
â€“Â Michael Homer
1 hour ago

add a commentÂ |Â

up vote
3
down vote

To address your first issue:

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

There is a simple and POSIX check for root:

#!/bin/sh

AmIRoot()

 [ "$(id -u)" -eq 0 ]

Alternatively, in Bash, more performance-driven coders might want to use:

#!/bin/bash

AmIRoot()

Note that I intentionally wrapped the code in functions for re-use.

To address your second issue:

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

edited 1 hour ago

answered 1 hour ago

Vlastimil

7,0791152126

sudo -u "$SUDO_USER" command...?
â€“Â Michael Homer
1 hour ago

add a commentÂ |Â

up vote
3
down vote

To address your first issue:

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

There is a simple and POSIX check for root:

#!/bin/sh

AmIRoot()

 [ "$(id -u)" -eq 0 ]

Alternatively, in Bash, more performance-driven coders might want to use:

#!/bin/bash

AmIRoot()

Note that I intentionally wrapped the code in functions for re-use.

To address your second issue:

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

edited 1 hour ago

answered 1 hour ago

Vlastimil

7,0791152126

To address your first issue:

how can I write "script would detect if it was running with the right permissions and not call sudo at all"?

There is a simple and POSIX check for root:

#!/bin/sh

AmIRoot()

 [ "$(id -u)" -eq 0 ]

Alternatively, in Bash, more performance-driven coders might want to use:

#!/bin/bash

AmIRoot()

Note that I intentionally wrapped the code in functions for re-use.

To address your second issue:

how can I improve its security to avoid the problem of giving superuser privileges to commands which don't need them when running the script with sudo?

edited 1 hour ago

answered 1 hour ago

Vlastimil

7,0791152126

edited 1 hour ago

answered 1 hour ago

Vlastimil

7,0791152126

answered 1 hour ago

Vlastimil

7,0791152126

answered 1 hour ago

Vlastimil

7,0791152126

sudo -u "$SUDO_USER" command...?
â€“Â Michael Homer
1 hour ago

add a commentÂ |Â

sudo -u "$SUDO_USER" command...?
â€“Â Michael Homer
1 hour ago

sudo -u "$SUDO_USER" command...?
â€“Â Michael Homer
1 hour ago

add a commentÂ |Â

draft saved

draft discarded

draft saved

draft discarded

Post as a guest

Name

Search This Blog

Iyfjky